Skip to content
International Centre for Critical Infrastructure Decision-Making

MAP, the ICCIDM Timing Assurance Framework

MAP is an open framework for assessing timing assurance. This page explains how it is built: its stages, domains and levels, the twenty-four cells, and how the score is derived.

Worked example: how MAP scores an organisation

MAP Score 9 out of 18. Band Developing. Position Measuring.

MAP Score

9 / 18

Band
Developing
Position
Measuring, Measure 1 of 2
  • Red, needs attention
  • Amber, in progress
  • Green, assured
Level by domainDependency, level 2 of 3. Tolerance, level 1 of 3. Ownership, level 2 of 3. Detection, level 1 of 3. Testing, level 2 of 3. Evidence, level 1 of 3.DependencyToleranceOwnershipDetectionTestingEvidence

Stage complete, domains at level 2 or above

Measure 1/2

Address 1/2

Prove 1/2

Stage score, sum of both domains, out of 6

Measure 3/6

Address 3/6

Prove 3/6

By domain, tap to open

1. Dependency2/3, Quantified

Level 2, Quantified: A documented inventory of timing-dependent systems and services, including those delivered by third parties.

2. Tolerance1/3, Recognised

Level 1, Recognised: Degradation is understood to be damaging. No figure exists.

3. Ownership2/3, Quantified

Level 2, Quantified: Named owner with defined scope, a budget line and a reporting route.

4. Detection1/3, Recognised

Level 1, Recognised: Some monitoring exists. Its coverage is unknown.

5. Testing2/3, Quantified

Level 2, Quantified: At least one completed test against a defined interference scenario, with results recorded.

6. Evidence1/3, Recognised

Level 1, Recognised: Some records exist. Completeness unknown.

Remedial actions, tap to locate on chart

Scope and caveats

MAP grades timing assurance, not incident response. Response is captured within Detection at levels 2 and 3.

MAP is derived from self-reported positions, not audit evidence. It is a diagnostic and a benchmark, not an audit standard.

Structure

Three stages, six domains, four levels.

  1. Measure

    • 1 Dependency
    • 2 Tolerance

  2. Address

    • 3 Ownership
    • 4 Detection

  3. Prove

    • 5 Testing
    • 6 Evidence

The four levels:

  1. 0Unexamined: the question has not been asked.
  2. 1Recognised: acknowledged as mattering. No figure exists that anyone could state.
  3. 2Quantified: documented, with a number and a source behind it.
  4. 3Assured: demonstrated, on a cycle, and current.

The dividing line between 1 and 2 is that a figure exists. The dividing line between 2 and 3 is that it has been demonstrated rather than asserted. These are facts about the organisation, not judgements about it, which is what makes the model assessable rather than a matter of opinion.

The twenty-four cells

Measure

1. Dependency

Where does precise time enter our operations, including through third parties, and do we understand that those signals can be deliberately attacked?

  1. 0Nobody has asked where precise time enters the organisation.
  2. 1Timing is known to matter. No inventory exists.
  3. 2A documented inventory of timing-dependent systems and services, including those delivered by third parties.
  4. 3The inventory is maintained on a cycle and reconciled against the important business services map.

2. Tolerance

What fails when time degrades, how badly, and how long could we keep operating?

  1. 0No view of what fails, or how quickly.
  2. 1Degradation is understood to be damaging. No figure exists.
  3. 2A stated operating window per service, and any GNSS-independent source documented.
  4. 3The window is derived from observed behaviour rather than estimate, and independent sources have actually been failed over to.

Address

3. Ownership

Does a named function own this, with the authority and the budget to act?

  1. 0No owner, or assumed to sit with IT without IT having accepted it.
  2. 1A function is named.
  3. 2Named owner with defined scope, a budget line and a reporting route.
  4. 3The owner reports on a cycle, and timing sits inside the organisation's resilience governance rather than beside it.

4. Detection

Would we know an interference event was happening while it was happening, and do we know what to do about it?

  1. 0No means of knowing.
  2. 1Some monitoring exists. Its coverage is unknown.
  3. 2Coverage documented, thresholds defined, alerts routed to a named recipient with a defined response action.
  4. 3Detection and response demonstrated against a live or simulated event, within a stated time to detect.

Prove

5. Testing

Have we tested, on a cycle, against a threat picture kept current?

  1. 0Never tested.
  2. 1Testing planned, not done.
  3. 2At least one completed test against a defined interference scenario, with results recorded.
  4. 3Testing on a defined cycle against a current threat picture, with findings tracked to closure.

6. Evidence

Could we demonstrate afterwards that our timing held?

  1. 0Nothing could be demonstrated.
  2. 1Some records exist. Completeness unknown.
  3. 2Timing records retained and traceable to UTC, sufficient to reconstruct a period.
  4. 3An evidence pack produced and tested against a real request from a regulator, auditor, customer or incident.

How the score is built

Every result rests on the same six numbers, read three ways. All three are always shown together.

MAP Score, progress

Sum of the six domain levels, range 0 to 18. Stage sub-scores: Measure, Address and Prove, each the sum of that stage's two domains, range 0 to 6.

Score bands:

MAP Score bands
MAP ScoreBand
0 to 4Unexamined
5 to 8Recognised
9 to 12Developing
13 to 15Managed
16 to 18Assured

The score is unordered. Capability earns its points wherever it sits in the six domains.

Position, where an organisation actually is

Stage completion is the count of that stage's two domains at level 2 or above, range 0 to 2. Level 2 is the threshold because it is the first level at which a figure exists. Position is named by the first stage not yet complete, and stages are sequence-gated, meaning a stage only counts once the one before it is complete:

MAP positions and the stage completion that defines each
PositionStage completion
UnexaminedMeasure 0 of 2
MeasuringMeasure 1 of 2
MeasuredMeasure complete, Address 0 of 2
AddressingMeasure complete, Address 1 of 2
AddressedMeasure and Address complete, Prove 0 of 2
ProvingMeasure and Address complete, Prove 1 of 2
Assuredall three stages complete

Why both numbers matter together

Score and position can diverge. An organisation with strong detection but no systems inventory can score respectably overall and still read as Unexamined, because detection sits in the Address stage and nothing in Measure has been completed yet. Where a later-stage domain sits two or more levels ahead of an earlier one, the result flags this directly rather than letting the headline score obscure it. It is a deliberate honesty feature of the model.

The score is never displayed without the position alongside it, for example: MAP Score 9 / 18, Measuring.

No composite percentage, no weighting. Three views of the same six numbers: the score for progress, the band for position, the grid for what to fix next.

Scope and caveats

These are shown with every result.

MAP grades timing assurance, not incident response. Response is captured within Detection at levels 2 and 3.

MAP is derived from self-reported positions, not audit evidence. It is a diagnostic and a benchmark, not an audit standard.